diff --git a/docker_swarm/roles/traefik/docker-stack.yml.j2 b/docker_swarm/roles/traefik/docker-stack.yml.j2
index 5ddc583..ef13029 100644
--- a/docker_swarm/roles/traefik/docker-stack.yml.j2
+++ b/docker_swarm/roles/traefik/docker-stack.yml.j2
@@ -55,11 +55,17 @@ services:
         - traefik.http.routers.esrom.tls=true
         - traefik.http.routers.esrom.tls.certresolver=letsencrypt
 
-        - traefik.http.routers.k3s.entrypoints=websecure
-        - traefik.http.routers.k3s.service=k3s@file
-        - traefik.http.routers.k3s.rule=Host(`cyberchef.k3s.kun.is`)
-        - traefik.http.routers.k3s.tls=true
-        - traefik.http.routers.k3s.tls.certresolver=letsencrypt
+        - traefik.http.routers.cyberchef-k3s.entrypoints=websecure
+        - traefik.http.routers.cyberchef-k3s.service=k3s@file
+        - traefik.http.routers.cyberchef-k3s.rule=Host(`cyberchef.k3s.kun.is`)
+        - traefik.http.routers.cyberchef-k3s.tls=true
+        - traefik.http.routers.cyberchef-k3s.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.freshrss-k3s.entrypoints=websecure
+        - traefik.http.routers.freshrss-k3s.service=k3s@file
+        - traefik.http.routers.freshrss-k3s.rule=Host(`freshrss.k3s.kun.is`)
+        - traefik.http.routers.freshrss-k3s.tls=true
+        - traefik.http.routers.freshrss-k3s.tls.certresolver=letsencrypt
     volumes:
       - type: bind
         source: /var/run/docker.sock
diff --git a/kubernetes/freshrss.yaml b/kubernetes/freshrss.yaml
new file mode 100644
index 0000000..9360b1e
--- /dev/null
+++ b/kubernetes/freshrss.yaml
@@ -0,0 +1,89 @@
+# We can use k3s's local storage provider for the persistent volume.
+# https://docs.k3s.io/storage
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: freshrss-env
+data:
+  TZ: Europe/Amsterdam
+  CRON_MIN: '2,32'
+  ADMIN_EMAIL: 'pim@kunis.nl'
+  ADMIN_PASSWORD: foo
+  ADMIN_API_PASSWORD: foo
+  PUBLISHED_PORT: '443'
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: freshrss-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: freshrss
+  labels:
+    app: freshrss
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: freshrss
+  template:
+    metadata:
+      labels:
+        app: freshrss
+    spec:
+      containers:
+      - name: freshrss
+        image: freshrss/freshrss:edge
+        ports:
+        - containerPort: 80
+        envFrom:
+        - configMapRef:
+            name: freshrss-env
+        volumeMounts:
+        - name: freshrss-data
+          mountPath: /var/www/FreshRSS/data
+      volumes:
+      - name: freshrss-data
+        persistentVolumeClaim:
+          claimName: freshrss-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: freshrss
+spec:
+  selector:
+    app: freshrss
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: freshrss
+  annotations:
+    kubernetes.io/ingress.class: "traefik"
+spec:
+  rules:
+  - host: freshrss.k3s.kun.is
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: freshrss
+            port:
+              number: 80
diff --git a/kubernetes/mysite.yaml b/kubernetes/mysite.yaml
index bad926b..f97ac7c 100644
--- a/kubernetes/mysite.yaml
+++ b/kubernetes/mysite.yaml
@@ -42,7 +42,8 @@ metadata:
     kubernetes.io/ingress.class: "traefik"
 spec:
   rules:
-  - http:
+  - host: cyberchef.k3s.kun.is
+    http:
       paths:
       - path: /
         pathType: Prefix